What do you have on the account?
Nothing you tick is transmitted. The score updates as you go.
Why two methods are often really one
The standard advice is to add more recovery options. It is not wrong, and it misses the part that decides whether you get back in: whether those options can fail together.
Three arrangements that look like redundancy and are not:
| What people set up | Why it fails | Fix |
|---|---|---|
| Recovery email at the same provider | One provider outage, or one compromised password, takes both | Use a different company entirely |
| Backup codes screenshotted into the mailbox | They are inside the thing you are locked out of | Print them, or use a password manager |
| Authenticator app and passkey on one phone | Lose the phone and both go at once | Keep one channel off that device |
This is why the checker scores channels rather than boxes ticked. Four methods that all route through one phone is a score of one.
What each method is actually worth
| Method | Strength | The catch |
|---|---|---|
| Recovery email (different provider) | Strong | Only if you still control it. Old work addresses fail here |
| Authenticator app | Strong | Tied to a device. Save its recovery codes separately |
| Passkey | Strong | Device-bound unless synced through your platform account |
| Backup codes stored offline | Strong | Worthless if stored in the account |
| Phone number | Moderate | Carriers recycle numbers; Microsoft is phasing SMS out |
| Still-signed-in device | Weak | A session, not recovery. Ends without warning |
| Password in a manager | Weak | Prevents needing recovery; does nothing once you do |
If the answer was bad
Fix it now rather than resolving to. The whole failure mode of account recovery is that the work is only ever urgent at the exact moment it has become impossible.
Provider-specific walkthroughs: recovering a Hotmail or Outlook account, adding non-phone recovery to a Google account, and what to use instead of a phone number if that is what you were avoiding.
Frequently Asked Questions
Does this tool see my account or my details?
Why does it care about independent channels rather than how many methods I have?
Is a phone number enough on its own?
Where should backup codes actually be stored?
Does a Resilient result mean I can never be locked out?
Why You Can Trust This Tool
- Nothing is transmitted. There is no network request in this page. Check the network tab.
- No credentials requested. It never asks what your recovery methods are, only whether you have them.
- Independently built. Not affiliated with, endorsed by, or sponsored by Google or Microsoft.
- Last reviewed: .